Subject: RE: [mobile-ip] fastv6 and CoAs

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Fri, 20 Sep 2002 02:54:42 +0200

> Sure. If the link layer is insecure, there are more 
  > problems than that. 

=> I'm not sure it's a link layer security issue. 
On a multiaccess link you can still see/spoof other
nodes' link layer addresses even if L2 encryption
is used. It's a property of a multiaccess link. 

On a p2p radio link, how does the new AR know which
"channel/port" the MN will attach to so that it can
disable (or enable with the right address) ingress
filtering.

Anybody
  > could spoof a standard ND message too.

=> This is not the same thing though. Ingress filtering
was developed as a tool that can help locate attackers.
The current draft kills that for some unknown period 
of time. 

Hesham

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 19 Sep 2002 18:15:06 -0700

Hello Hesham,

the prefix used in matching the source address
should also include the appropriate prefix(es) valid on the
previous access router. Since the access routers
are assumed to have a trust relationship, the
additional prefix(es) can be configured manually, or else, with
an API permitting, through HI/Hack.

-Rajeev

---

From: "James Kempf" <[email-masked]>
Date: Fri, 20 Sep 2002 09:16:42 -0700

Hesham,

> disable (or enable with the right address) ingress

I wasn't talking about encrypting the packets, I was talking about someone
sending a packet with somebody else's MAC address. On switched Ethernet, 802.1x
locks down a port to a particular MAC address and no other MAC address can use
it nor can any MAC address send from another port (though I am told in practice
that many switch products roll over to using shared access if more hosts try to
connect than there are ports).

On 802.11, any host can spoof a MAC address, there's no ports to lock down.

> The current draft kills that for some unknown period

Like I said in  a previous email, the ingress filtering can be established based
on the MAC address. The MAC address is sent by the old router to the new in the
HI/HaCK exchange. The new router can use that to perform ingress (actually
egress) filtering.

Alternatively, the old CoA must be sent along with the HI/HaCK, in order that
the source route at the new router be properly constructed. The new router can
use the old CoA to perform ingress filtering.

            jak